Re: [tpm2] using TPM2 NVRAM for storing LUKS password

[Patrick Ohly <patrick.ohly at intel.com>]

[-- Attachment #1: Type: text/plain, Size: 1662 bytes --]

On Fri, 2017-11-10 at 06:53 -0500, Stefan Berger wrote:
> Other possibilities, you have an old libtpms library that's being
> picked up that may have had a bug?

I indeed didn't have the latest code, but for other reasons - see my
other email. It's working now :-)

> > BTW, should the swtpm instance above really terminate when qemu
> > disconnects? It currently does, although -terminate is not given.
> 
> It is terminated by QEMU issuing a shutdown on it. I think it's
> better than leaving stale swtpm processes running.

That it explains it. I was just wondering.

Having swtpm spawned by QEMU avoids exactly this issue with lingering
processes, even when QEMU itself gets killed and doesn't get around to
shut down the TPM properly. Unfortunately the QEMU developers didn't
buy that argument :-/

> > How can I enable more debug logging inside swtpm? Increasing the
> > level
> > does not really provide much useful information.
> > 
> 
> There's not much debugging output inside the TPM 2 code. Some fatal 
> errors, such as not swtpm not being able to write the TPM2 state
> file should show up, though.

Just to close on this, --enable-debug also enables additional output,
doesn't it? I haven't actually used it, though, because it leads to an
assertion in swtpm when using TPM2 (https://github.com/stefanberger/swt
pm/issues/54).

-- 
Best Regards, Patrick Ohly

The content of this message is my personal opinion only and although
I am an employee of Intel, the statements I make here in no way
represent Intel's position on the issue, nor am I authorized to speak
on behalf of Intel on this matter.